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1 This action is in response to the communication filed on 4/7/2005. 

2 DETAILED ACTION 

3 Response to Arguments 

4 The numbering of claims is not in accordance with 37 CFR 1 . 126 which requires the 

5 original numbering of the claims to be preserved throughout the prosecution. When claims are 

6 canceled, the remaining claims must not be renumbered. When new claims are presented, they 

7 must be numbered consecutively beginning with the number next following the highest 

8 numbered claims previously presented (whether entered or not). 

9 However, as the examiner had previously, and improperly, suggested that the claims be 

10 renumbered, and in order to expedite prosecution of this application, the examiner has allowed 

1 1 the renumbered claims to be entered. However, as there are now two claims numbered 34, and 

12 two numbered 61, and no claims 28, or 55, the examiner has provided the following correction. 
13 

14 Original claims 29-34, and 56-61 have been renumbered to 28-33, and 55-60 



15 respectively. As such, claims 7-27, 34-54, and 61-81 are pending and claims 1-6, 28-33, and 

16 55-60, and 82 have been cancelled. 

17 



1 8 Applicant's arguments with respect to the previously applied prior art have been 

1 9 considered but are moot in view of the new ground(s) of rejection. 

20 Claims 7-27, 34-54, and 61-81 have been examined. 
21 
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1 Claim Rejections - 35 USC §103 

2 The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 

3 obviousness rejections set forth in this Office action: 

4 A patent may not be obtained though the invention is not identically disclosed or 

5 described as set forth in section J 02 of this title, if the differences between the subject matter 

6 sought to be patented and the prior art are such that the subject matter as a whole would have 

7 been obvious at the time the invention was made to a person having ordinary skill in the art to 

8 which said subject matter pertains. Patentability shall not be negatived by the manner in which 

9 the invention was made. 
10 

1 1 Claims 7-13, 16-24, 27, 34-40, 43-51, 54, 61-67, 70-78, and 81 are rejected under 35 

12 U.S.C. 103(a) as being unpatentable over Hruska et al. (US Patent Number 6, 195,587) 

13 hereinafter referred to as Hruska, and further in view of Le Pennec et al. (US Patent Number 
. 14 6,892,303) hereinafter referred to as Le Pennec. 

15 Regarding claims 7, and 17, Hruska disclosed a computer program product for 

16 controlling a computer to detect malware, said computer program product comprising (See 

1 7 Hruska Abstract and Col. 3 Lines 40-54 where it was implied that a computer program product 

1 8 was implemented in this system because the system relies on processors, which rely on computer 

19 programs): file access request detecting logic operable to detect a file access request to a 

20 computer file by a requesting computer (See Hruska Col. 3 lines 63-65); file access clearance 

21 request generating logic operable to generate a file access clearance request including data 

22 identifying said computer file (See Hruska Col. 3 Lines 20-24 and Col. 4 Lines 20-23); file 

23 access clearance request transmitting logic operable to transmit said file access clearance request 

24 from said requesting computer to an assessment computer responsible for assessment of whether 

25 said computer file contains malware (See Hruska Col. 3 Lines 20-24 and Col. 4 Lines 20-23); 
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1 file access clearance request receiving logic operable to receive at said assessment computer said 

2 file access clearance request from a requesting computer (See Hruska Col. 5 Lines 60-66); file 

3 access clearance response generating logic operable in dependence upon said data identifying 

4 said computer file to determine if said computer file has previously been assessed as not 

5 containing malware and to generate a file access clearance response (See Hruska Col. 5 Lines 3- 

6 10); file access clearance response transmitting logic operable to transmit said file access 

7 clearance response to said requesting computer (See Hruska Col. 5 Lines 66-67); file access 

8 clearance response receiving logic operable to receive at said requesting computer said file 

9 access clearance response from said assessment computer (See Hruska Col. 4 Lines 45-52 and 

10 Col. 5 Lines 66-67 wherein it was implied that the requesting workstation received the report 

1 1 because the file server sent the report to the workstation and the workstation used the report); and 

12 file access permitting logic operable if said file access clearance response indicates said 

13 computer file does not contain malware to permit said file access request by said requesting 

14 computer (See Hruska Col. 4 Lines 45-52), and wherein said assessment computer stares a 

1 5 database of computer files including for each file a checksum of the file when last determined to 

16 be valid (See Hruska Col. 5 Lines 14-18 and 22-25), but Hruska failed to disclose wherein said 

17 database includes for each computer file a persistence flag indicating whether an entry relating to 

18 said computer file should be purged from said database during purge operations. 

19 Le Pennec teaches that in a virus detection system, in order to improve virus detection, a 

20 virus-free certificate should be associated with a file and stored in a database (See Le Pennec 

21 Col. 5 Lines 29-34 and Fig. 5 and associated text) as well as teaching that each certificate should 

22 have a hit count (511) which is used to determine if the certificate will be removed from the 
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1 database upon adding a new certificate to a "full" database (See Le Pennec Fig. 7 and associated 

2 text). 

3 It would have been obvious to the ordinary person skilled in the art at the time of 

4 invention to employ the teachings of Le Pennec in the virus detection system of Hruska by 

5 utilizing the virus-free certificates in place of the checksums of Hruska. This would have been 

6 obvious because the ordinary person skilled in the art would have been motivated to improve 

7 upon the virus detection of Hruska. 

8 Regarding claims 8, and 18, Hruska and Le Pennec disclosed that said data identifying 

9 said computer file includes a checksum value calculated from said computer file (See Hruska 

10 Col. 3 Lines 1-3 and Col. 4 Lines 13-16 and Le Pennec Fig. 5). 

1 1 Regarding claims 9, and 19, Hruska and Le Pennec disclosed that said data identifying 

12 said computer file includes one or more of a filename of said computer file, data identifying said 

13 requesting computer and a storage location of said computer file (See Hruska Col. 5 Lines 43-48, 

14 and 51-56 and Le Pennec Fig. 5). 

15 Regarding claims 10, and 20, Hruska and Le Pennec disclosed that if said file access 

16 clearance response indicates a scan of said computer file is required by said assessment 

1 7 computer, then computer file transmitting logic is operable to transmit said computer file from 

18 said requesting computer to said assessment computer, receiving at said assessment computer 

19 said computer file from said requesting computer and performing a malware scan of said 

20 computer file (See Hruska Col 4 Lines 20-23 and 26-40 and Col. 5 lines 10-13). 
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1 Regarding claims 1 1 and 21, Hruska and Le Pennec disclosed that if said file access 

2 clearance response indicates access to said computer file is denied, then triggering a denied 

3 access response in said assessment computer (See Hruska Col. 5 Lines 18-22). 

4 Regarding claim 22, Hruska and Le Pennec disclosed that if said file access clearance 

5 response indicates access to said computer file is denied, then triggering a denied access 

6 response in said requesting computer (See Hruska Col. 4 Lines 52-55). 

7 Regarding claims 12 and 23, Hruska and Le Pennec disclosed that said assessment 

8 computer stores a database of computer files previously assessed as to whether they contain 

9 malware (See Hruska Col. 5 Lines 14-18). 

10 Regarding claims 13 and 24, Hruska and Le Pennec disclosed that said database includes 

1 1 for each computer file fields specifying one or more of a filename of said computer file, data 

12 identifying said requesting computer and a storage location of said computer file, a checksum 

13 value calculated from said computer file, an access flag indicating whether access to said 

14 computer file is denied and a persistence flag indicating whether entries relating to said computer 

15 file should be purged from said database during purge operations (See Hruska Col. 5 Lines 14-18 

16 and 22-25 and Le Pennec Fig. 5). 

17 Regarding claims 16, and 27, Hruska and Le Pennec disclosed that a plurality of 

1 8 requesting computers share access to an assessment computer for determining whether file 

19 access requests by those requesting computers should be denied (See Col. 5 Lines 26-40). 

20 Claims 34-40, 43-51, and 54 are rejected for the same reasons as claims 7-13, 16-24, and 

21 27 respectively, and further because Hruska disclosed the method of the above rejected claims 

22 (See Hruska Abstract). 
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1 Claims 61-67, 70-78, and 81 are rejected for the same reasons as claims 7-13, 16-24, and 

2 27 respectively, and further because Hruska disclosed the system of the above rejected claims 

3 (See Hruska Abstract). 
4 

5 Claims 14-15, 24-25, 41-42, 52-53, 68-69, and 79-80 are rejected under 35 U.S.C. 103(a) 

6 as being unpatentable over Hruska and Le Pennec as applied to claims 7, 17, 34, 44, 61, and 71 

7 above respectively, and further in view of Caccavale (US Patent Application Publication Number 

8 2002/0129277). 

9 Hruska and Le Pennec disclosed denying access to files in the event that they contain 

10 characteristic forms of viruses (See Col. 1 Lines 62-65 and Col. 4 Lines 45-55), but failed to 

1 1 disclose a message being sent to the file server indicating a switch to a mode of operation 

12 wherein more files are denied for access. Hruska does, however, disclose that a user can indicate 

13 that all files need to be checked by the file server regardless of prior results (See Hruska Col. 4 

14 Lines 55-57). 

15 Caccavale teaches that it is often the case that a virus checker program is unable to detect 

16 a new virus (See Caccavale Paragraph 0075 Lines 1-2). Caccavale further teaches that in such a 

17 case, an updated anti-virus pattern file should be distributed to the virus checker program, at 

1 8 which point all the files can be marked as unchecked in order for all the files to be checked for 

1 9 the new virus using the new pattern (See Hruska Paragraph 0075). 

20 It would have been obvious to the ordinary person skilled in the art at the time of 

21 invention to employ the teachings of Caccavale in the file checking system of Hruska and Le 

22 Pennec by sending new anti-virus patterns to the file server, and in response to receiving the new 
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1 pattern, marking all the files as unchecked and needing to be scanned. This would have been 

2 obvious because the ordinary person skilled in the art would have been motivated to protect the 

3 workstations from files containing new viruses that the file server did not know of when the file 

4 was originally scanned. In this manner, the fileserver would rescan all the files with a greater 

5 likelihood of finding a virus and therefore denying access to more files. 

6 Conclusion 

1 Claims 7-27, 34-54, and 61-81 have been rejected. 

8 Applicant's amendment necessitated the new ground(s) of rejection presented in 

9 this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). 

10 Applicant is reminded of the extension of time policy as set forth in 37 CFR 1 .136(a). 

1 1 A shortened statutory period for reply to this final action is set to expire THREE 

12 MONTHS from the mailing date of this action. In the event a first reply is filed within TWO 

13 MONTHS of the mailing date of this final action and the advisory action is not mailed until after 

14 the end of the THREE-MONTH shortened statutory period, then the shortened statutory period 

15 will expire on the date the advisory action is mailed, and any extension fee pursuant to 37 

16 CFR 1 .136(a) will be calculated from the mailing date of the advisory action. In no event, 

17 however, will the statutory period for reply expire later than SIX MONTHS from the date of this 

1 8 final action. 

19 Any inquiry concerning this communication or earlier communications from the 

20 examiner should be directed to Matthew T. Henning whose telephone number is (571) 272-3790. 

21 The examiner can normally be reached on M-F 8-4. 
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If attempts to reach the examiner by telephone are unsuccessful, the examiner's 



2 supervisor, Ayaz Sheikh can be reached on (571) 272-3795. The fax phone number for the 

3 organization where this application or proceeding is assigned is 571-273-8300. 



5 Application Information Retrieval (PAIR) system. Status information for published applications 

6 may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 

7 applications is available through Private PAIR only. For more information about the PAIR 

8 system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR 

9 system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would 

1 0 like assistance from a USPTO Customer Service Representative or access to the automated 

1 1 information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 



4 



Information regarding the status of an application may be obtained from the Patent 
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